Annual Report to Parliament on the Privacy Act 2021 to 2022

1. Introduction

The Privacy Act (PA) protects the privacy of Canadian citizens and permanent residents against the unauthorized use and disclosure of personal information about them held by a government institution. It also provides individuals with a right of access to that information and the right to correct inaccurate personal information. In addition, the PA legislates how the government collects, stores, disposes of, uses and discloses personal information.

Section 72 of the PA requires that the Head of every federal government institution submit an Annual Report to Parliament on the administration of this Act over the fiscal year. The Minister of Public Safety Canada has delegated the administration of the PA, including the reporting of the Annual Report, to the Commissioner of the Correctional Service of Canada (CSC).

This report describes how CSC fulfilled compliance with the PA during the fiscal reporting period of April 1, 2021 to March 31, 2022.

2. Organizational Structure

2.1 About Correctional Service of Canada

The purpose of the federal correctional system, as defined in law, is to contribute to the maintenance of a just, peaceful and safe society by carrying out sentences for offenders sentenced to two years or more imposed by courts. This is done through the safe and humane custody and supervision of offenders, and by assisting the rehabilitation of offenders and their safe reintegration into the community as law-abiding citizens through the provision of programs in penitentiaries and in the community (Corrections and Conditional Release Act, s.3).

CSC works closely with its Public Safety portfolio partners, including the Royal Canadian Mounted Police (RCMP), the Parole Board of Canada (PBC), the Canada Border Services Agency (CBSA), and the Canadian Security Intelligence Service (CSIS), in addition to oversight bodies including the Office of the Correctional Investigator (OCI).

2.2 The Access to Information and Privacy Division

The Access to Information and Privacy (ATIP) Division reports to the Director General of Rights, Redress and Resolution under the Policy Sector and has eight units:

• Intake, Processing and Retention Unit (ATIP Administrative Team)
• Access to Information Operations
• Privacy Operations
• Policy and Governance
• Disclosure and Law Enforcement
• ATIP Transformation (Backlog)
• Digitization and Stakeholder Liaison
• Strategic Compliance, Reporting and Client Management

The Intake, Processing and Retention Unit (IPRU), is responsible for processing incoming requests, generating routine correspondence, tasking retrievals, quality assurance of the ATIP process, preparing final release packages, responding to calls received on ATIP’s Toll Free number, and providing general support to the office.

The Access to Information Operations team is responsible for reviewing records, conducting consultations, applying exemptions and exclusions, preparing release packages for applicants, and responding to complaints from the Office of the Information Commissioner (OIC).

The Privacy Operations team processes formal and informal requests under the PA and responds to complaints from the Office of the Privacy Commissioner (OPC). The regional employees assigned to ATIP work with this team to support the fast track of files. This team has been organized into three teams:

1. The Privacy Urgent Team is responsible for responding to urgent formal privacy requests (e.g. documents requested by offenders/requesters for upcoming parole hearings, court purposes or other legal proceedings where time is of the essence).
2. The Fast-track Team is responsible for reviewing offenders’ records related to health care, employment, admission and discharge, visits and correspondence, education and training, and grievances.
3. The Privacy Complaint Team is responsible for responding to delay complaints received by the OPC and to any judicial review applications related to these complaints.

The Policy and Governance Unit (PGU) acts as a single point of contact for privacy within CSC. It develops privacy policies, guidelines, tools and procedures to support ATIP requirements within CSC. In addition, the unit provides advice, guidance and support regarding ATIP legislation and related policies; promotes privacy awareness; and manages privacy breaches and any improper collection, use and disclosure complaints filed with the OPC. The unit also oversees Privacy Impact Assessments (PIAs); reviews Memoranda of Understanding, Information Sharing Agreements, contracts, forms and Commissioner’s Directives; and delivers privacy training. The PGU is also responsible for the informal review of disciplinary, harassment and workplace violence reports for the department. This also includes complex privacy requests related to investigations and other sensitive files.

The Disclosure and Law Enforcement Team oversees files for requests under 8(2) of the PA, including files for litigation; dangerous offender applications and long-term supervision orders; other court purposes; and on-going investigations. This team was created in the last quarter of the fiscal year and is overseen by the PGU. It is expected that this team will be fully operational by the end of August 2022.

The ATIP Transformation Teams (Backlog Teams) are responsible for processing files from CSC ATIP’s backlog, including assessing areas of ATIP operations that could be streamlined to foster efficiencies in addressing current legacy requests and preventing future backlog of requests.

The Digitization and Stakeholder Liaison Team is responsible for CSC ATIP’s digitization and modernization initiative, including leveraging new technology and the digitization of the ATIP process within CSC.

The Strategic Compliance, Reporting and Client Management Team (SCRC) is responsible for collecting, analyzing and presenting information using various search engines and data tools to support ATIP in its reporting requirements and compliance rates. When fully operational in Fall 2022, this team will also be responsible for managing CSC ATIP’s relationships with its clients, and will promote and foster a culture of client satisfaction within CSC’s ATIP Division.

In addition, each sector, region, institution, district, parole office and community correctional centre has an ATIP liaison who assists the national ATIP Division in administering its overall responsibilities.

Next fiscal year, ATIP will continue to build its capacity, including the addition of an Access team, Privacy teams, two dedicated teams for the review of disciplinary, harassment and workplace violence reports and related privacy formal requests, and more employees for policy work.

During the 2021-2022 fiscal year, there were 84 employees dedicated to privacy activities as follows:

• 79 full-time employees
• 4 part-time and casual employees
• 1 regional staff

2.3 Initiatives and priorities

CSC is a large organization that employs approximately 18,000 employees across Canada while managing a yearly average of 21,000 offenders. The highest proportion of ATIP Division work in CSC are Privacy requests, effectively accounting for more than 90% of the total workload, while Access requests represent about 10% of all ATIP requests. Offenders and their legal representatives make 67% of the privacy requests.

Similar to several federal institutions, CSC has been facing many compelling challenges that have significantly increased during the past five fiscal years. However, CSC has taken important steps and launched many initiatives to address its challenges and better position ATIP for the future. At the beginning of the 2021-2022 fiscal year, CSC developed an ambitious Strategic Action Plan with the following objectives:

1. Gradually increase ATIA and PA compliance rates to attain the Treasury Board Secretariat (TBS) compliance standards;
2. Increase customer satisfaction;
3. Ensure production outpaces requests;
4. Minimize and eventually eliminate existing backlog requests;
5. Sustain productivity to prevent future backlog of requests; and
6. Take measures to become an employer of choice and a leader in the ATIP Community.

More details on CSC’s Strategic Action Plan are outlined later in the report. In the meantime, some of the challenges CSC has been facing for several years include:

• A persistent backlog: currently 8.4 million pages. An average of 2 million pages (7,000 requests) received annually. On average, CSC was only able to process approximately half that amount with the staff complement it had prior to 2021-2022;
• A high number of historical backlog files, some dating back to 2013;
• An exponential increase (4,541%) in requests for review of high risk and sensitive files (e.g. litigation files) – high risk and sensitive files represent approximately 21% of the total workload;
• A disproportionally low number of staff to respond to the demands (54 Full Time Equivalents [FTEs] before 2021-2022);
• Requests becoming increasingly more complex, multi-faceted, inter-connected (multiple requests submitted by same requestor – largely from offenders or their legal counsel);
• A limited interest on the part of offenders to use their Case Management Team as an immediate source of request for information on their files, which drives formal ATIP requests for information;
• Technology challenges (e.g. Protected B server not suitable for Protected C or Secret documents and inmates with no access to internet);
• High staff turnover due to heavy workload, high stress and multiple competing priorities;
• Retention issues due to reliance on short-term contracts before 2021-2022 to increase staff complement; and
• A shortage of ATIP experts broadly in the federal community, thereby leading to competition with other employers and ATIP community both in public and private agencies.

Given the need to address these challenges and foster an environment to support CSC’s ability to comply with its legislative obligations, CSC refocused its activities to respond to its ATIP requirements through the following actions:

1. Temporary funding to increase production

From 2017-2018 to 2020-2021, CSC ATIP implemented and examined many initiatives to address its challenges, which were described in its previous Annual Reports. During this period, CSC ATIP started building an ATIP work environment designed to increase its competitive advantage. As such, it succeeded in augmenting its overall complement on a temporary and permanent basis. In addition to its 54 FTEs, its contingent workforce consisted of a growing number of individuals that were hired as casuals/term/part-time employees or as consultants to execute work on a non-permanent, per-project basis, as well as to increase overall production and reduce the backlog.

During the same period, the ATIP Division also continued to manage many competing priorities, including an increasing number of requests related to legal proceedings, which are sensitive and urgent in nature. To manage its backlog and its numerous competing priorities, CSC ATIP used its resources as efficiently and as strategically as possible. Therefore, it focused on developing efficient performance indicators, which helped to identify key strategic priorities, create specialized teams and reallocate resources accordingly.

In order to mitigate the most significant risks for the organization, CSC ATIP identified and focused on five key strategic priorities:

1. Reviewing high risk and sensitive files (e.g. complaints under investigation by the Information and Privacy Commissioners; judicial reviews; court orders; litigation; disciplinary/harassment/workplace violence investigation reports);
2. Implementing a fast-track approach for privacy requests;
3. Responding to current privacy requests (to meet legislative timeframes for health care files);
4. Expediting the release of requests where a quick review is possible; and
5. Implementing an informal disclosure process at the lowest level (regional and local levels).

To date, the above outlined efforts have led to four main results:

1. Dedicated teams within the ATIP Division were created to focus on the above-noted key strategic priority areas. With the passage of time, they have now developed a certain level of specialization that highly contributes to enhance timeliness of responses, facilitate cohesion, and ensure better and more consistent review methods.
2. CSC noticed an approximate 30% increase in total production (1.3 million pages in 2019-2020, up from one million pages in 2018-2019).
3. In fiscal year 2019-2020, with the additional temporary resources, it is worth underlining a 281% increase in the production of the access to information files (Sources: ATIP Dashboard 2021-02-23 and Key Stats February 2021).
4. The ATIP Division significantly reduced the access backlog requests by at least 45% (470,193 pages to 257,230 pages) (Sources: ATIP Dashboard 2021-02-23 and Key Stats February 2021).

Despite the fact that the above-mentioned strategies yielded very positive results, particularly in fiscal year 2019-2020, it became obvious that CSC needed to adopt a more robust plan to address its legacy and still exponentially growing backlog. To meet all legal requirements pursuant to the PA and the ATIA, CSC needed to adopt a permanent and long-term solution. Building on the intermediate outcomes from these activities, CSC enhanced its actions and developed a concrete and tangible plan with the 2021 Strategic Action Plan.

2. The 2021 Strategic Action Plan:

In light of the above, in fiscal year 2021-2022, CSC developed a Strategic Action Plan to address all issues/challenges described above on a more permanent basis. The comprehensive Strategic Action Plan focuses on four pillars: (1) Our Resources and People; (2) Our Infrastructure; (3) Our Culture and Practices; and (4) Our Results.

These four pillars identify various opportunities for (i) additional resources, including leveraging partnerships with academic institutions; (ii) working with our Information Management experts to strengthen our technological capabilities to fully digitize our ATIP processes; (iii) promoting a culture of client satisfaction; and (iv) ensuring accountability for timely and sustainable results.

Pillar 1: Our resources and people

Improving compliance with obligations under the PA and the ATIA is a high priority for CSC. The organization has forecasted it will require approximately 130 FTEs to meet all its obligations under both Acts. During fiscal year 2021-2022, CSC ATIP has already secured human and financial resources for CSC’s ATIP program/function to allow a gradual increase in its production and compliance rates for both Acts. As such, during fiscal year 2021-2022, CSC has increased its complement from 54 to approximately 88 FTEs. During fiscal year 2022-2023, CSC ATIP will continue to focus on hiring the outstanding additional staff required to meet its legal obligations under the ATIP legislation.

To provide high quality service standards to Canadians and offenders, the ATIP Division must attract the right people for the job. To overcome the shortage of ATIP experts in the community, CSC has been hiring and training individuals with transferable skills who are seeking careers in the Public Service and ATIP. To that effect, CSC is increasing its presence in local universities and colleges to recruit students who are interested in pursuing a career in ATIP at CSC.

It is also CSC’s desire to position itself as an employer of choice. CSC ATIP is therefore also focusing its attention on the continuing education and well-being of its staff. This includes equipping staff with proper tools, and training and mentoring analysts to increase their knowledge and application of the Acts.

CSC ATIP is also using talent management to invest in the organization’s most important resource – its people. To this end, CSC may recruit candidates with highly desirable skill sets and provide ongoing learning and development opportunities. It will also recognize the value of its team members and encourage them to advance within the organization. Talent management is one of the many tools that CSC ATIP is using to recruit, retain and develop a workforce that is as productive as possible and likely to stay with the organization on a long-term basis.

Equally important, CSC ATIP is working on creating a Developmental Program for ATIP analysts. At the same time, CSC is focusing on promoting the well-being of staff and ensuring there is appropriate mental and physical health support in managing the demands of their duties and functions.

Pillar 2: Our infrastructure

Together with investments in resources and people, CSC is also putting the emphasis on modernizing its infrastructure to keep up with the changing reality of the ATIP environment and its associated challenges.

A team of specialists, led by a Deputy Director, Digitization and Stakeholder Relations, is responsible for CSC ATIP’s digitization and modernization initiative. CSC will leverage technology to streamline the ATIP process. For example, as an interim measure, CSC has been working with its Preventive Security experts to use its Security Intelligence Network (SiNET) as a platform to collect Protected C documents when it has to process information requests from the courts and law enforcement agencies. The lessons learned on the interim project will assist in the implementation of a robust digitization initiative moving forward, including access to a Secret server to properly and efficiently manage and process Secret and Protected C documents.

Given that offenders account for the majority of the privacy workload, and offenders and their legal representatives make 67% of the privacy requests, CSC will explore the feasibility of implementing an Offender Portal. This option has many benefits including: (1) providing inmates access to technology with the opportunity to submit their ATIP requests electronically; (2) reducing the delays in receiving offender requests; (3) reducing/eliminating the amount of paper used to print the release packages to provide them to the offenders; and (4) significantly reducing mailing costs and delays in releasing documents to offenders.

Pillar 3: Our culture and practices

From the initial ATIP request to ultimate disclosure, CSC’s practices must embody a culture of responsibility and client satisfaction. To achieve this goal, CSC will continue to foster close relationships with key external organizations and keep apprised of best practices, including improving our engagement and consultation with the Offices of the Privacy and Information Commissioners, and TBS’s Office of the Chief Information Officer.

CSC will also promote a right-of-access and client satisfaction culture. This culture shift will encourage employees to recognize the rights of individuals to access their personal information and CSC’s duty to enhance government accountability and transparency. CSC will also enhance engagement with ATIP requesters to swiftly seek clarity where required and minimize delays in fulfilling their requests.

To serve our clients to the best of our abilities, the ATIP Division will also explore ways of processing requests more efficiently. To this end, CSC will increase consultation with Offices of Primary Interest (OPIs) in collecting and assessing information to ensure timely responses to requesters’ needs.

Furthermore, with additional resources, the ATIP teams will be able to play key and proactive roles in providing orientation, training and awareness to minimize legal risks and privacy breaches within the organization. In doing so, CSC ATIP will engage with regional management committees, institutional management committees, executive committees, sectors and regions to share best privacy practices and bring much-needed awareness in the areas of privacy and access to information.

Pillar 4: Our results

The ATIP Division is positioning itself not only to become an employer of choice, but also to be seen as a leader, a model and a flagship in the ATIP Community. CSC ATIP is therefore committed to increase PA and ATIA compliance rates over time, with the goal of attaining TBS compliance standards. It is very confident these three objectives will be achieved when its Strategic Action Plan is fully implemented – positive and very promising preliminary results achieved in 2021-2022 effectively suggest that CSC is on the right track.

Positive and promising preliminary results:

Phase 1 of the 2021 Strategic Action Plan entailed, among other things, the creation of new teams including the Backlog Transformation Teams, the Digitization and Stakeholder Relations Team and the Disclosure and Law Enforcement Teams (DLET).

The creation of the Backlog Teams yielded positive results with an approximate 133% increase in production in 2021-2022 (from approximately 936,083 pages closed in 2020-2021 to approximately 2,177,848 million pages closed in 2021-2022) (Sources: ATIP Dashboard 2022-04-04 and ATIP Dashboard 2022-07-05). Furthermore, it is worth noting that for the first time since 2013-2014, the total number of pages closed outpaced the total number of pages received (2.1 million pages closed in 2021-2022 versus 2 million pages received) (Source: ATIP Dashboard 2022-04-04). CSC will aim to minimize and eliminate the existing legacy requests over the next three years, and will strive to sustain productivity to prevent developing future backlog.

Production in previous years:

Source: ATIP Dashboard 2022-04-04

The following graph shows that during fiscal year 2021-2022, for the first time since 2013, the backlog stopped increasing as CSC ATIP was successful in starting to flatten the backlog curve. The graph also shows that the total number of pages closed slightly outpaced the total number of pages received to a point that both lines merged for the first time since 2013.

CSC aims to increase and maintain efficiency in processing ATIP requests, eliminate the current backlog, and avoid accumulating further legacy requests. To achieve this goal, CSC ATIP production must continue to outpace the number of requests received.

Success will only be sustainable if CSC addresses both those historical requests as well as new requests simultaneously. These efforts, combined with targeted investments and cultural changes, will better equip CSC ATIP to move from reactive to proactive, and to deal with inevitable new complexities and challenges in the future. This goal will be achieved with the implementation of Phase 2 of the Strategic Action Plan in fiscal year 2022-2023.

Phase 2 of the Strategic Action Plan effectively entails, among other things, the creation of new ATIP teams to gradually increase ATIAand PA compliance rates to meet TBS compliance standards.

The ATIP Division has already started to create three of these teams. These three teams are composed of 20 new FTEs, including 1 PM-06 and 3 PM-05s (Team Leaders) and they should be fully operational in Fall 2022. CSC ATIP has already started training Team Leaders and is currently in the process of hiring the remaining members of the three teams. One of the three new teams will become the second Access team, thereby increasing capacity to respond to all new access to information requests in a timely fashion. CSC ATIP is confident that the implementation of Phase 2 of the Strategic Action Plan will allow it to fully comply with the ATIA and to uphold the right of access of Canadians and offenders. Preliminary discussions about this strategy occurred between CSC ATIP and representatives of the OIC and both agreed that once fully implemented, this strategy should significantly and positively improve response times under the ATIA and CSC’s performance.

Furthermore, as previously mentioned, in 2021-2022 CSC ATIP created the DLET whose responsibility will be to manage and process all information requests for litigation and court purposes. CSC ATIP has collaborated with CSC’s Preventive Security and Intelligence and the Legal Services Unit (LSU) to establish these ATIP teams with knowledge in security operations and law. Hand over will take place this Fall. At this time, these specialized teams will be fully trained and ready to respond to Crown, court, and law enforcement requests, thereby freeing up resources which will be reallocated to the processing of current privacy requests to increase compliance rates with the PA.

The level of specialization of the CSC ATIP Privacy Complaint Team has also highly contributed to reducing our legacy backlog and enhancing timeliness of responses. The Privacy Complaint Team generated very positive results in 2021-2022 – this team was responsible for a 60% decrease in privacy complaints. At the beginning of fiscal year 2020-2021, this team was managing approximately 374 PA requests with active complaints assigned to them compared to 150 at the end of March 2022.

The number of privacy complaints filed against CSC is steadily declining (from 440 complaints filed in 2017-18 to only 130 complaints in 2020-2021). This is mainly due to the following two reasons:

• Hundreds of bold commitments made to the OPC from 2017-2018 to 2019-2020; and
• The creation of the Privacy Complaint Team in Fall 2020.

Privacy Act complaints accepted against CSC by fiscal year:

Source: OPC’s 2020-2021 Annual Report to Parliament on the Privacy Act and the Personal Information Protection and Electronic DocAct at Table 9.uments

The total number of access to information complaints filed against CSC has remained stable.

CSC ATIP is committed to closing and resolving privacy and access complaints promptly – previous results show movement in the right direction. CSC ATIP is currently building capacity for the current privacy and access teams with the goal of achieving single digit access and privacy complaints by the end of fiscal year 2022-2023.

3. Options to avoid/curb future workload increases

Cultural changes and related options to avoid/curb future workload increases will also assist CSC ATIP to achieve its goals. For example, CSC ATIP continues to explore informal release of documents. To that effect, it completed in-house work to identify ways to simplify and streamline the ATIP process, including launching a Pilot Project in three operational sites – Grande Cache Institution, Stony Mountain Institution and Bowden Institution – in 2021-2022.

The Informal Release Pilot Project will assess an implementation plan for informal information sharing with offenders and conduct a needs assessment to support digitization of the ATIP process. Based on a review of current and historical data, a 15 to 20% reduction in workload is expected, which will allow ATIP to focus on other priorities.

4. Pilot project with the Department of Justice

In 2021-2022, CSC ATIP and CSC LSU – Department of Justice (DOJ) have launched a Pilot Project entitled the Disclosure Review Process (DRP) 2.0 for litigation files. The DRP developed a process for the collection and review of documents that needed to be processed on an urgent basis and in a timely fashion for litigation purposes. Through this process, litigation teams lead the review of the collected CSC documents and determine what information is relevant, and carry out the review and apply protections to all files, with the exception of more sensitive files, including the Preventive Security and Discipline and Dissociation files. They also determine whether there are concerns with release, such as privileged information.

CSC’s LSU and DOJ litigation teams engage the DLET for their review of all relevant information contained in the Preventive Security and Discipline and Dissociation files, and any other security-related information. This approach prevents “double-work” e.g. where files are reviewed more than once or where second reviews are unnecessary. DOJ lawyers are trained to recognize personal information and protect it if it is not relevant for court purposes. As such, there is no value added for them to consult CSC ATIP to confirm and identify personal information included in the low-risk files. However, DOJ will consult the DLET to obtain expert advice on complex files involving security issues.

From June 2, 2021 to March 31, 2022, about 25 files were officially approved for this pilot project. Preliminary results indicate this approach contributed to a decrease of 46,247 pages in CSC ATIP’s workload (Source: Approved DRP 2.0 Pilot Cases 2022-06-10). Moving forward, CSC ATIP will apply this approach to all low risk files, which should decrease its total workload even more while avoiding “double-work” and ensuring that documents are provided to the courts in a timely fashion.

Goals and vision moving forward

In the 2022-2023 fiscal year, CSC ATIP will turn its focus to:

• Strengthening areas of opportunity for improvement as an employer of choice;
• Increasing ATIA and PA compliance rates to meet TBS compliance standards;
• Increasing customer satisfaction;
• Ensuring production outpaces requests;
• Minimizing and eventually eliminating the existing backlog;
• Sustaining productivity to prevent future backlogs;
• Examining options to avoid future workload Increases;
• Researching and implementing digitization of service; and
• Providing training and awareness to prevent beaches of personal information and increase employees’ ATIP knowledge.

3. Delegation Order

The Commissioner of CSC is responsible for the administration of the PA. The Minister delegates this authority to members of departmental senior management, including the ATIP Division Departmental Coordinator (ATIP Director), to carry out their powers, duties, and functions under the Act, in relation to ATIP requests. Certain authorities are delegated to particular positions in the ATIP Division at National Headquarters (NHQ) as shown in Appendix A of this report.

4. Performance 2021-2022

4.1 Requests Processed Under the Privacy Act

In 2021-2022, CSC received 5,981 requests for personal information, an approximate 4% decrease from the previous year. A total of 24,628 requests were carried over from the previous reporting year, totaling 30,609 requests requiring processing in 2021-2022. CSC responded to 6,065 requests for personal information, representing 20% of the total number of requests received and outstanding from the previous reporting period. Please refer to Appendix B for the Statistical Report.

This graph shows the total workload of privacy requests as a sum of requests received during the reporting period and requests outstanding from the previous reporting period. The line illustrates the trend of files closed. As the graph outlines, there was a significant increase in the number of requests closed in 2021-2022, which can be attributed to the work completed by the new Backlog teams. This trend will continue as efficiencies continue to be implemented to address the long-standing backlog.

4.2 Disposition of Requests

Of the 6,065 requests completed during the 2021-2022 reporting period, 547 requests were full disclosures; 1,571 were partial disclosures; 9 were withheld in their entirety; no records existed for 991; 2,946 were abandoned by the requesters; and 1 was neither confirmed nor denied. In summary, 9% of requests were full disclosures and 26% were partial disclosures.

4.3 Exemptions and exclusions

The majority of exemptions invoked by CSC were under three sections of the PA:

• Section 19 was applied in 799 cases (16%) to protect information obtained in confidence;
• Section 22 was applied in 1,698 cases (34%) to protect information relating to law enforcement and investigations; and
• Section 26 was applied in 2,263 cases (46%) to protect personal information of individuals.

4.4 Extensions

A total of 5,258 extensions were required during this reporting period. Most of the extensions were taken due to a large volume of requests (5,229), and the others were due to a large volume of pages (28) and requiring further review to determine if any exemptions were warranted (1).

4.5 Completion Time

During the reporting period, CSC completed 494 requests in 30 days or less; 212 requests between 31 and 60 days; 157 requests between 61 and 120 days; 131 requests between 121 and 180 days; and 5,071 requests in over 180 days.

4.6 Deemed Refusals

Over the years, an increasing number of files have been closed beyond the legislated timeline. During this fiscal year, 89% of the requests (5,426) were closed beyond the legislated timeline, representing a 1% decrease from last fiscal year (90%).

4.7 Outstanding requests

At the end of this fiscal year, 24,544 requests were outstanding and were carried over to the 2022-2023 reporting period. Of those 24,544 requests, 4,975 were received during this fiscal year, whereas 3,794 were received during the previous fiscal year 2020-2021. Also, 422 outstanding requests were received during fiscal year 2015-2016 or earlier; 2,596 in 2016-2017; 4,383 in 2017-2018; 4,168 in 2018-2019; and 4,206 in 2019-2020. Most of these requests, 24,038 in total, were beyond the legislated timelines as of March 31, 2022.

4.8 Outstanding active complaints

During this reporting period, CSC received a total of 143 complaints, a 65% decrease in the number of complaints received during the last fiscal year (411 complaints in 2020-2021). Of those 143 complaints, 58 remained active and were carried over to the next fiscal year 2022-2023. Other complaints carried over to fiscal year 2022-2023 include 15 complaints received during fiscal year 2020-2021, 4 complaints received in 2019-2020, 6 complaints received in 2018-2019, 13 complaints received in 2017-2018, and 1 complaint received in 2016-2017. A total of 97 complaints were therefore still active as of March 31, 2022. Finally, a total of 173 findings were issued.

The majority of privacy complaints received during this reporting period are related to delay/time limit complaints, followed by denial of access.

4.9 Consultations from other institutions and organizations

The ATIP Division’s workload involves responding to consultations in response to formal requests received by other institutions and organizations. CSC works closely with its partners in the Public Safety portfolio such as CBSA, RCMP, CSIS and PBC in an effort to respond to consultations in a timely fashion. CSC is consulted on such subjects as court cases, offender grievances, OCI matters, offender files, and deported individuals.

During the 2021-2022 reporting period, the ATIP Division received a total of 20 consultations from other government institutions and organizations, and started the fiscal year 2021-2022 with an additional 14 consultations carried over from the previous fiscal year 2020-2021.

4.10 Disclosures made pursuant to Paragraph 8(2)(e) of the Privacy Act

During the 2021-2022 fiscal year, 119 disclosures pursuant to paragraph 8(2)(e) of the PA were made by CSC.

4.11 Informal requests

During the reporting period, CSC received 408 informal requests. A total of 156 requests were carried over from the previous reporting year, totaling 564 informal requests requiring processing in 2021-2022. These include:

• releasing information through informal means where possible; and
• processing requests under subsection 8(2) of the PA, excluding paragraphs 8(2)(e) and (m).

A total of 381 informal requests were closed during 2021-2022, with a total of 260,360 pages released.

In addition, the PGU reviewed records informally for CSC with the spirit of the Act at the forefront, including disciplinary, harassment and workplace violence reports; information sharing agreements/Memoranda of Understanding; contracts; Commissioner’s Directives; and forms. The PGU processed 540 of these requests, totaling 39,709 pages reviewed and 27,159 pages released.

4.12 COVID-19 impact

With the exception of a four-week period from January 22, 2022 to February 23, 2022, when the ‘Freedom Convoy’ was underway, ATIP’s operations were not affected during this reporting period; however, processing of Protected C documents remained a challenge, as they cannot be reviewed remotely. Staff were required to go to the office to process these files that resulted in some delays.

5. Training and Awareness

The PGU plays a fundamental role in developing and delivering training to employees at NHQ, Regional Headquarters and at the institutional level across Canada, as well as the ATIP staff, on ATIP related matters.

During this fiscal year, the ATIP Division did not offer training and awareness sessions. This is due to challenges presented by the pandemic, the backlog and related heavy workload, and the increasingly urgent and competing priorities. As CSC ATIP is building its capacity, it is our intention to resume training once additional staff are on-boarded.

PGU continues to provide advice, and answer questions and concerns regarding training, policy and guidelines, and interpretations of the Acts through its generic email account. Through the use of these email accounts, CSC staff is provided with a single point of contact to increase their knowledge of the ATIP legislation and related policies.

6. Policies, guidelines and procedures

Over the past year, the ATIP Division has continued to update internal guidelines and procedures as required, including:

• Continued working with provincial Crowns to finalize the Memorandum of Understanding for a streamlined process in response to court proceedings for dangerous offender designation and long-term supervision orders;
• Continued to participate in the PA Modernization working group;
• Ensured the ATIP’s information on CSC’s intranet and internet sites were kept up-to-date;
• Updated the internal Privacy Breach Guidelines and the Privacy Impact Assessment Guidelines;
• Liaised with Labour Relations to update the Manager’s Guide to Discipline to ensure the protection of personal information is embedded within it;
• Liaised with DOJ to streamline processes for sharing of information for litigation purposes;
• Conducted statistical reporting in response to PA requests to ensure accuracy and improved coordination; and
• Streamlined operating procedures.

7. Complaints, Compliance Investigations and Audits

As a result of the OPC’s investigations, recommendations, and the number of privacy complaints received (and carried over), CSC’s ATIP Division undertook several strategic measures to respond to complaints during this 2021-2022 period. For example:

• CSC ATIP continues to prioritize providing timely responses. The Division remains focused on building its human resource component and dedicating staff to reducing the backlog.
• CSC ATIP worked closely with OPIs to resolve complaints and implement necessary corrective measures.
• CSC ATIP worked closely with the OPC on outstanding complaints and will continue to make this a priority in the new fiscal year.
• The ATIP Division has continued to make use of a divisional complaints coordinator in order to work closely with the OPC to respond to formal complaints and queries using a single point of contact.

There were no audits undertaken during this fiscal year.

CSC received 19 new complaints related to the improper collection, use and disclosure of personal information – 10 complaints were carried over from previous fiscal years. During this fiscal year, 16 complaints were closed and 13 were carried over to fiscal year 2022-2023, 11 of which are pending a finding from the OPC.

8. Monitoring Compliance

The ATIP Division runs reports from AccessPro Case Management on a regular basis in order to manage its workload with the ultimate goal of meeting legislated timeframes. A report created to monitor the outstanding complaints with the OPC is also provided to the ATIP Director on a bi-weekly basis.

CSC ATIP produces a weekly report for senior management that outlines various outputs, including the number of requests received, closed, and outstanding.

In addition to the reports, the IPRU actively monitors and triages incoming requests, regularly reporting to senior management any requirement to reassess priorities and redistribute workload to improve performance.

9. Material Privacy Breaches

During the 2021-2022 reporting period, the ATIP Division reported 36 material privacy breaches to the OPC and TBS. These breaches consisted of disclosure of personal information (1) due to human error; (2) to outside parties; (3) electronic access to information without a need to know; and (4) theft/loss of records/electronic assets.

CSC takes breaches of personal information seriously and continues to educate staff on the protection of personal information as follows:

• A continued and ongoing component of CSC training includes a comprehensive section on privacy breaches.
• Staff are continuously reminded of their obligations to safeguard and protect personal information and adopt privacy-sensitive approaches in the workplace.
• The ATIP Division continues to work with all liaisons and management regarding reporting requirements, implementing corrective measures and prevention.
• CSC ATIP leveraged relationships with the OPC and TBS to provide specialized expertise to senior management on the protection of personal information, including delivering an information session on breaches in one of our regions.
• ATIP continues to monitor Situation Reports on a daily basis to ensure all breaches have been reported in accordance with TBS’s Guidelines for Privacy Breaches and CSC’s Breach Guidelines.

10. Privacy Impact Assessments

In accordance with TBS policy, CSC undertakes PIAs to ensure new and re-designed programs, initiatives and projects involving the collection, use, disclosure and retention of personal information are complying with the PA.

In fiscal year 2021-2022, one PIA was completed – the National Intercept Centre (NIC).

The NIC is an initiative led by our Preventive Security and Intelligence Division to centralize intercept activities at CSC’s NHQ. It was established to ensure national oversight, administration and governance, thereby reducing corporate risks, and will more effectively leverage intelligence information obtained from intercepted communications to ensure the security of the institution and safety of any persons.

A full executive summary of the PIA is available on our website.

11. Public Interest Disclosures

Paragraph 8(2)(m) of the PA permits the disclosure of personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates.

During the 2021-2022 fiscal year, 11 disclosures pursuant to paragraph 8(2)(m) of the PA were made by CSC. 10 of the public interest disclosures were made to family members/next of kin following a death while in the care and custody of CSC. The OPC was notified before all of the disclosures occurred. The remaining disclosure was made to other authorities and was related to the release of personal information of an offender incarcerated in another country.

12. Federal Court

The ATIP Division received five Notices of Application for Judicial Review in this reporting period, most stemming from time delay complaints by the OPC.

Appendix A: Delegation Order

Privacy Act Delegation Order

The Minister of Public Safety pursuant to section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercises the powers, duties and functions of the Minister as the head of Correctional Service of Canada, under the provisions of the Privacy Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders:

Appendix B: Statistical Report on the Privacy Act

Statistical Report on the Privacy Act

Name of institution: Correctional Service Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Appendix C: 2021-2022 Supplemental Statistical Report on the Access to Information and Privacy Act

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Correctional Service Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)